The "hdfs" user (more specifically, whatever user launched the NameNode process) is the HDFS super-user. The super-user has full access to the file system and also administrative operations. You can declare additional users to be super-users by setting property dfs.permissions.superusergroup in hdfs-site.xml. The default value of this property is "supergroup".
dfs.permissions.superusergroup supergroup The name of the group of super-users.
Any user you add to group "supergroup" (or whatever custom group you use if you decided to change dfs.permissions.superusergroup) will be treated as an HDFS super-user.
It's important to keep in mind that this grants both full file system access and full administrative access. That means the user would be able to call sensitive operations like "hdfs dfsadmin -safemode enter". If this isn't appropriate, then you might explore using file system permissions and ACLs to implement your requirements on the file system only.
More details are in the documentation here:
http://hadoop.apache.org/docs/r2.7.0/hadoop-project-dist/hadoop-hdfs/HdfsPermissionsGuide.html